You're listening to a stage talk titled Chinese
influence operations and disinformation campaigns.
This week we were joined by DoubleThink Labs
Jasper Hewitt as we explored the new forms of
propaganda. We discussed spam of large operations
in the US elections to AI influencers pushing
state lines on TikTok, along with some tool and
reading recommendations along the way. This talk
was hosted by me, Charlotte Ma, on Thursday the
8th of May 2025 in the Bellencat Discord server.
Well, for another stage talk. This week, we're
speaking about digital influence operations and
disinformation campaigns. An MIT study back in
2018, which feels like forever ago, found that
fake news was 70 % more likely to be retweeted
on Twitter than real news. And that was before
Musk's takeover. So you can imagine what that
looks like now. While state -led influence operations
have happened for years, but the use of internet,
and in particular social media, as a means of
running information operations has grown prominently
over the past decade. The Chinese Communist Party
is one such political power that uses digital
influence operations and disinformation campaigns
to advance the party's interests in the region
and further afield. Jasper Hewitt joins us here
from DoubleThinkLab. DoubleThinkLab researches
malign Chinese influence operations and disinformation
campaigns and their impacts via the digital tools
and methodologies they have developed. As an
analyst, Jasper's focus has been on PRC influence
operations during the Taiwanese and US elections,
and he's currently investigating how official
PRC accounts use the MetaAd library to expand
their content's reach. We'll jump into all of
that in a second. But first, a short reminder,
if you'd like to ask a question, please do so
in the chat as we talk. And please note within
your question, if you do not want me to read
your username out, as this is being audio recorded
and will appear on podcast platforms. Okay. Jasper,
before questions, can you tell us a little bit
more about your work? And while you do so, I
will mute. Yes, so first of all, thank you for
that great introduction and thanks for having
us, having Double Think Lab here. This is a great
opportunity to talk to the whole community. So
yeah, as she just said, Double Think Lab is a
Taiwanese organization. We're an NGO and we've
been founded in 2019 and yeah, we mostly conduct
research into PRC influence operations. Now,
I'm on the digital intelligence team, so I'm
mainly responsible for tracking and reporting
on all of the inauthentic accounts. And we're
also developing automated tools to track these
accounts because, of course, this is a very time
consuming work. So if we can automate it, then
we do that wherever possible. But I can talk
about that more in the Q &A. So yeah, today I
just want to give you first say a few things
about FEMI or influence operations and how that's
different from fake news and disinformation.
And then I just want to give you a crash course
into PRC influence operations. So we're going
to talk about spamouflage, which is the biggest
one. And I'm going to tell you about how spamouflage
has been evolving over the last few years. Yeah,
FEMI. So FEMI stands for Foreign Information
Manipulation and Interference. It's a very long
name, but it's basically a different term for
foreign influence operation. Now the key term
there is foreign. So we're mostly concerned with
information that goes from one country to another
and then tries to influence the political debate
in that second country. Femi is different from
fake news and disinformation because not all
influence operations are disinformation. So people
can say something that is true, right? You can
just say like, oh, I really like that political
candidate. And that's not necessarily fake news,
but we care mostly about the method. That's something
how information is spread. So we're looking for
coordinated inauthentic behavior. So it's methods
over over content. So if we find that there's
like a thousand inauthentic accounts saying,
for example, that BYD is an amazing company,
then that would be a reason for us to to investigate.
Now, if we look at PRC influence operations,
there's several actors that are involved in this.
So obviously, there's the PRC state media, right?
This is really big and they all have they're
all very active on social media on several platforms.
And then there's influencers. Now, some of these
influencers have direct ties to the PRC government
with some influencers. It's not as clear if they
have ties to the PRC government, but people suspect
that they do. And then there's spamouflage. So
that's tens of thousands of, if not more, fake
accounts that are basically just spamming the
internet with pro -PRC messages. So, yeah, spam
has been defined as a massive cross -platform
propaganda infrastructure. It was first discovered
by Grafica in 2019. So Ben Nemo actually gave
it the name spam because they would camouflage
their propaganda with spam. So, yeah, you wouldn't
only see propaganda. It would be like pictures
of beautiful scenery or pictures of attractive
individuals or random book quotes. And then suddenly
there would be this PRC propaganda. Now in 2023,
Metta actually attributed spammaflage to PRC
law enforcement. So this was a very important
finding, but it basically it basically proved
what everybody was already thinking, right? Because
all of this stuff was so pro -PRC that there
could really be only be one entity behind it.
Now, what is the camouflage saying? Because this
has also changed over time. At the beginning,
they were mostly concerned with issues that are
sensitive to the PRC. So for example, prominent
dissident Guo Wengui, he was targeted at the
start, and then Hong Kong with the protests,
COVID, and then also Xinjiang and Tibet. But
over time, the campaign just became more overall
pro PRC, anti -west. They started going after
specific countries. So the USA is obviously a
big target. Taiwan is a very big target. I think
we're right at the forefront here in Taiwan.
And then Japan, the Philippines, maritime disputes.
These are all topics that Spamouflage is touching
on. So, for example, during the US elections,
these accounts were also very active. And they
were basically criticizing domestic issues, but
also US foreign policy, like, for example, US
support for Israel, for Ukraine. And they were
critical of both presidential candidates. They're
also going after individuals, so specific dissidents,
also smaller dissidents, not just the super high
profile ones. They're all being targeted by this
campaign. So their social media accounts, sometimes
in the comment sections, you'll read a lot of
hate comments. And those are also attributed
to this camouflage. Now, what do these accounts
look like? So I'm going to talk a little bit
about how they operate. And then you can maybe
also use some of that info to find these accounts
yourself if you're interested in it. So many
of these accounts, they would use profile photos
of women, mostly Asian women. And many of these
photos have been taken from small Chinese influencers.
So I personally think this is really messed up
because these people, technically speaking, cannot
use Western platforms themselves. But then an
influence operation attributed to their government
is taking their photos to put them out there
on these Western platforms. The accounts mostly
swarm around the larger state media accounts
and also influencers. So if you look at some
state media accounts or accounts from diplomats,
for example, Zhang Heqing is a big one. He used
to be the diplomat to Pakistan, and now he's
a big personality on X. And if you go through
his posts and you look at his retweets, most
of it will be, you will see his camouflage. Now,
these accounts usually have a division of labor.
So there's like cedars and then there's amplifiers.
So seeders would post the initial content, and
then there's like 20 amplifiers below that, that
their only job is just to repost that. We think
that the accounts are side work accounts, so
to say. So they're like hardly operated by scripts,
but they're also definitely real people behind
it. So we know that there's real people behind
it because they are actually most active during
PRC working hours. So if you... plot their activity,
you will see that's from nine to five in PRC
working time. And then they also have a lunch
break between 12 and two. So you can actually
see that activity drop. So sometimes they'll
also make robotic posts. So for example, sometimes
at the beginning, there's robotic boot quotes
when the accounts just start. And those also
happen outside of working hours. Because obviously,
when you run a script, there's no need to be
in the office. If you think of a fake account,
then many people might think of an account that
was just created the other day and has very little
followers or something. But we actually found
that many of the, specifically the Cedar accounts,
they were created like back in 2012, 2011, and
they have huge followings. So we found some accounts
that have more than 70 ,000 followers, 50 ,000
followers. And it's not that The PRC was very
early with making all of these accounts. We found
that actually many of them have been hacked.
So those were inactive accounts that haven't
been used for a very long time. And then they
got hacked, and then they probably got sold to
the people running Spamouflage. So one funny
example with an account that we were tracking
during the US election is when we finally get
to get all of their posts through the API, we
found that back in 2011, this account belonged
to a radio show in Texas. And then after that,
it was just inactive for like 12 years. And then
suddenly it became a spamflash account. We also
found that these accounts appear to buy third
party, like retweet amplification, especially
on X. So during our investigation, we found over
a thousand accounts that artificially boost these
spamflash posts. And these accounts were actually
crypto accounts and Web3 accounts that normally
speaking have a lot of, normally speaking, all
of their reposts are of like large crypto accounts
like ChainGBT or London Real TV. So it was really
interesting to see that. in those timelines,
suddenly you would see these spam of flash posts
popping up. So there's some interesting dynamics
going on there. It's not like they do everything
in house. There's definitely some collaboration
going on with spam companies, potentially also
from other countries. Now, spam of flash is notoriously
ineffective. So many researchers say that spam
of flash has failed to get a lot of authentic.
authentic interaction over time. So yeah, what
I just said, they buy their retweets, many of
their followers and their retweets or other spam
of flash accounts. So yeah, should we really
be caring about this? Well, today I'm here to
say that, yes, I think we should keep caring
about spam of flash because it is evolving and
they are definitely trying to find new ways to
become more relevant. So I'm now going to share.
two or three examples of what we found in which
we can see that spam of flash is becoming more
relevant, I think. So during the U .S. elections,
they were continuing what they were always doing,
like posting a lot of pro -PRC stuff and saying
some critical things about the United States.
But we also saw something new. And this was called
MegaFlash. So there were these spam of flash
accounts that were impersonating Trump supporters.
And this was first discovered by Elise Tomas
at the Institute for Strategic Dialogue. And
yeah, there were these accounts that really pretended
to be American. So they had like in their bio,
they had like all these American flags and said
like stuff like hashtag NRA and stuff like that.
They were interesting because it was harder to
prove that they were connected to spamaflash.
So whereas normally speaking, spamaflash is very
straightforward. They just post a lot of pro
-PRC stuff. So it's very easy to kind of see
where their allegiance lies. But then with these
accounts, they didn't post any pro -PRC stuff.
They just posted pro -Trump stuff, which was
really weird. We were tracking a bunch of these
accounts and we already had the idea that maybe
these accounts were connected to the campaign
because some of the crypto accounts were also
amplifying these accounts. And then their posting
times were also in PRC working times, even though
they all claimed to be Americans, which is weird
because that would be the middle of the night
in the United States. And then, at some point,
they made this... So, Sprimal Flies is very clumsy.
They sometimes make very clumsy mistakes. And
then, at some point, like seven out of the 15
accounts that we were tracking, they suddenly
posted this account in Chinese criticizing the
Falun Gong, which was just completely out of
context of what they were doing before. And I
think after that, they kind of realized that
the batch was compromised. They just left those
accounts and they haven't been used since. So,
these accounts are still online. If you go through
our US election report, then you can find the
account name. Now, another thing, one specifically
interesting account, it goes by the name of Edward
D. Mayer. It's also still going today, even though
we've reported on it many times. This account
actually became really relevant. I think it's
been the most successful spam camouflage account
that we've been tracking over the last few months.
So this account actually gamed the whole X algorithm
by posting Street Fight videos. So instead of
boring spam, like some scenery, this account
found that if he posts Street Fight videos, then
the algorithm just boosts his posts. So he got
some Street Fight videos for which he got like
9 million views. And this kind of spilled over
to some of the propaganda posts that he would
make. So on some of the propaganda posts, he
would get like 100 ,000 views. Now, this is a
very weak spillover, but still a very big difference
from what Spamouflage usually gets in terms of
interaction. So with the other Spamouflage accounts,
we maybe look at like 10 ,000 views, 15 ,000
views on a good day, and then 20 ,000 views would
be like the jackpot, at least for what we check.
But this account really managed to game the algorithm.
and found a very interesting way to become more
relevant. At some point, this account got a warning
label to its account from X saying that it was
posting violent content and that influenced how
it got recommended by the algorithm. After that,
the account became irrelevant again. But he still
continued like he created a few new accounts
that I think were done by the same operator.
And he also created like an X community, which
was also interesting to see sort of trying out
all these new functions. And this account was
also actively replying to authentic users with
large following. So he was just like talking
to some people and saying stuff about immigration
and then people would actually respond to it
and go into into dialogue with it. So, yeah,
this was a very interesting finding, and it shows
that Spamouflage, they don't sit still and stay
irrelevant. They really look for ways to become
more relevant. Now, another thing that they've
been doing is experimenting with artificial intelligence,
of course. So I'm happy to talk more about that
in the Q &A, because it's a big topic. But yeah,
another thing that they've been doing is experimenting
with new platforms. So there's a lot of new platforms
popping up, right? Blue Sky, Threads, and especially
Threads is huge in Taiwan. I think for now, for
young people, Threads is probably the most important
platform in Taiwan. And Taiwan is going through
some political challenges right now. Yeah, there
have been a lot of influence operations from
spam of flash targeted at Taiwan, specifically
at the ruling party right now. So in this case,
we also see a similar pattern. So also the spam
of flash pattern, like spam and then propaganda.
But it's more like the mega flash. It's not overly
pro -PRC because they know that most Taiwanese
people don't necessarily associate with that.
So it's more toned down. It's more like with
the mega flash. They're only posting specific
political messages that they think people might
associate themselves with. And some of these
posts actually already reached more than 80 ,000
views and 9 ,000 likes on the political posts.
So this is very, very high compared to what we
saw on X. This might also be related because
the threats algorithm just works differently.
And yeah, on Blue Sky, we've also seen a few
spam of large accounts popping up. And Blue Sky
is particularly interesting because it has a
really good open API. I don't know if anyone
played around with it yet, but Blue Sky is just
the ultimate platform to create an army of bots
and just let it run. So yeah, but nobody is really
using it yet or not enough people are using it
yet. So if everybody switches to Blue Sky tomorrow,
that would be very interesting. And also, It's
also a lot easier to do analysis on Blue Sky
because the biggest challenge, I think, in this
work has been that all of the platforms are closing
down their access to researchers. So CrowdTangle
disappeared, right? Got replaced by the content
library, but it's not the same. And the X API
is, yeah, basically completely closed off, right?
You have to pay a lot of money. I think if you
want to get a million tweets per month now, you
need to pay five thousand USD a month. And in
the past, a researcher could get two million
tweets per month for free. So, yeah. And TikTok
is also a challenge in itself because the video
format is just, yeah, kind of a pain in the ass
to find information, especially because their
search function is very incomplete. If you just
typed like. if you do a keyword search, then
it just gives you like 10 random videos or 20
random videos from random years that it thinks
you might be most interested in. So it's very
difficult to do like exhaustive research there.
So yeah, I think that's it for me and we can
go to the Q &A. Amazing. Thank you. Yeah, I think
most people within this audience or at least
in the Bellicat staff side have experienced that
frustration with the the tools closing down to
monitor social media sites. Before going to audience
questions, I was intrigued actually to ask you
what the differences are, particularly as we've
got such a research -based audience. What's unique
about researching Chinese disinformation campaigns
in comparison, for example, with US state -led
disinfo or Russian state -led disinfo campaigns?
Are there any unique obstacles or anything that
researchers who are used to looking at, for example,
Russian propaganda might be surprised to encounter
when it comes to Chinese propaganda. Yeah, I
have to be really honest in that I don't know
enough necessarily about the Russian disinfo
campaigns. This is something that I know that
I should get more into, but I keep postponing
it. I think perhaps the language element, the
language aspect is very unique, maybe, to the
Chinese influence operations. In the beginning,
many of these accounts would post a lot in Chinese,
but then now they're slowly using more English.
Also, now there's AI, so it's more easy to just
translate, oh, so there's less language mistakes.
But if you're looking at influence operations
from the PRC towards Taiwan, which is interesting
because they both technically use the same language,
right? But then there's a difference in the characters
that Taiwan and China use. So Taiwan uses the
traditional characters and China uses simplified
characters. look for in posts that we think might
come from the PRC is we're looking for mistakes
in the conversion in the conversion between those
characters. So many PRC threat actors, they will
write a post in simplified and then they'll throw
it through software to convert it to traditional
characters. And then there's always mistakes
there. So, yeah, we're kind of like always looking
for these simplified characters that might give
us a hint. Yeah, absolutely. You can often find,
for example, with Russian disinfo campaigns as
well, language, even in translated English, can
help you spot if something is potentially misleading
or not, because often the language translation
isn't incredible and, as you mentioned, is often
based on translation bots online. We've got quite
a few questions coming through. We've had a few,
because you mentioned about the nature of social
media as well. Sia Skippy asked, has X's moderation
of disinformation varied with the nation of origin
and content of the disinformation? As in, do
different countries get different and different
governments get different treatments? And kind
of mentioned with that, Ozkom said, you've mentioned
that you've tried to get these accounts banned
with little effect. What other mitigation opportunities
do you see? So when you're looking at social
media, Does moderation change depending on where
these disinformation campaigns come from? And
how what other mitigation opportunities do you
see when banning these individual accounts doesn't
work? Okay, so I'm not sure if there's if there's
a difference in terms of in terms of geography,
like if you do it in this country, or if you
do it in other country, what I did notice is
there's a difference in time. So if we find an
account now and we write on it, I really highly
doubt whether X will ever delete it. But when
we were doing this research during the US elections,
like in the weeks leading up to the actual election,
and we had a collaboration with Voice of America.
So Voice of America was just churning out articles
about this all the time. And back then, we did
notice that a lot of accounts that they reported
on actually got deleted, like in the days after
the article broke. And in some cases where we
really found that someone was being impersonated,
for example, and then an ex -spokesperson actually
came out to say something about this and said
that they deleted that specific account. So I
guess at that point, even ex itself realized
that they had to do something. because otherwise
there might be too much pressure on them that
they're not doing anything. And there's other
accounts like, for example, the pay for repost
accounts that I mentioned, like the crypto accounts,
they were banned very, very rapidly. But I think
that's just like an anti -spam campaign that
they always have running and it's not necessarily
related to disinformation. But like those thousands
of accounts that we found back then, I think
all of them have been deleted today. So in terms
of other methods for mitigation, if the platform
doesn't want to take it down, I don't really
see another thing that you can do. Maybe if a
lot of people report it, maybe at some point
they will do it. I also am very skeptical about
that. So I think the best thing you can do is
to just tell other people about it so that everybody
knows that this kind of this badge exists and
that people are aware that these kind of accounts
belong to an influence operation. And that's
especially relevant right now for Taiwan, where
so many people are on threats. And right now
there's so many disinformation going on on threats
and normal people are seeing it in their daily
lives and are talking about it at work. Yeah,
I think just calling it out and calling out that
this exists can sometimes already be enough.
Absolutely. We have seen a pattern personally,
though, at Billingcat, for example, and I know
a couple of other news organizations have as
well. When it comes to news impersonation, when
there's tactics where they're impersonating news
organizations, for example, calling it out has
actually given these individual accounts more
viewership and more engagement. So then they've
been using that as a tactic. And we've seen an
outtake in, for example, in terms of the Russian
disinformation context, people, Russian disinfo
drivers, emailing and trying to get the attention
of European fact -checkers, for example, so that
they can fact -check the content to then drive
more engagement their way. Interesting model
that has been working for them and is something
that we've spoken about in a stage talk before.
We've got so many questions rolling in. I'm hoping
I can keep up with them all. Just keeping on
the social media side and as you were talking
about the spammer flage, particularly within
the election that you spoke about, Skirskippy
asked earlier as well, how many of those followers
of these accounts are themselves legitimate or
bots? For example, my experience on Twitter is
that accounts just naturally accrue totally authentic
followers at a steady rate. Is there kind of
a secondary group of bots that are being created
to amplify those particular tweets or those particular
posts? Is that part of the plan? Or are these
real people kind of getting suckered in to kind
of the propaganda and the messaging? Yes. So
this is a very important question. And I don't
know if you're familiar with the breakout skill.
So this was also developed by Ben Nemo. So the
breakout skill, basically, when you look at disinformation
or influence operations, you want to see like,
did this post break out of its initial bubble.
And the initial bubble is just an inauthentic
bubble with just a bunch of fake accounts that
are following each other and are liking each
other. And then if it breaks out of that bubble,
you would be in category two. And if it breaks
out on multiple platforms, you'd be in category
three. And then it just keeps going up. So we're
always trying to look for if these accounts are
getting authentic interactions from real accounts.
And it's difficult to look at all the followers.
It's possible, but if you have these large accounts
that I mentioned earlier, like these hijacked
accounts, those are tens of thousands of followers.
I think it might be somewhat of a waste of time
to go through all of their followers. So what
we usually do is we look at the comment section.
Because the comment section of spammer flash
accounts are very, let's say, Most of the other
spam and flash accounts that comment on these
posts, they all agree. They all say stuff like,
yes, yes, good point, stuff like that. It's very
kind of like monotone. But if at some point you
see replies that disagree with the post, or you
maybe see replies with people saying stuff like,
oh, this is weird, or whatever for some reason,
then you can assume that this post has somehow
reached authentic users. So I think that's the
easiest way to see that. Yeah. And then, yeah,
just a little more on that. So I think they themselves,
Spammouflage itself is creating more and more
Spammouflage accounts to then follow all of these
accounts and also repost them. And then on the
other hand, I think they're also buying it from
third party. So like spam companies, they're
also buying likes and reposts. You mentioned
that in terms of the propaganda aimed at Taiwanese
population, that's happening a lot on threads.
We've actually had a question from Sohan D'Souza
who's asked, would you please advise regarding
optimal techniques for threads investigations?
The advanced search doesn't seem too bad, but
transparency even via external services seems
lacking. Could you speak a little bit about how
the difficulties and the ease of investigating,
particularly on threads, is that's a new platform
that many of the researchers, for example, in
the audience may be new to and want advice on.
Yeah, sure. So I think one thing that's difficult
about threads is that everything is new. So sometimes
when people look for fake accounts on X because
in most cases, it still are like new accounts,
right? So you would suddenly see an account that
was created like three months ago saying all
this stuff. But then like on threads, it's not
weird to have an account that was created three
months ago because everybody is just joining
this year. But yeah, I think threads is available
in the content library now if you have access
to that, but it has a lot of limitations, like
only certain accounts you will see. So it's not
very helpful. What I think is a very useful tool
is there's this add -on that you can get in the
Chrome store. It's called Single File. And it
basically just lets you get a .html file of the
whole page that is currently loaded. So you can
just go to someone's timeline, and you can scroll
all the way down, and you can click the add -on.
And then it will just download a .html file of
that whole. of that whole page. So that would
include all the posts, all the images. And what
you can also do after that is you can write a
script to organize that data into a data frame.
So technically speaking, you're not scraping.
You're not using Selenium and stuff. So Facebook
won't detect you and ban your account, because
you're just using this tool to get all of the
HTML. And then you can do with that data what
you want after. Another thing that's difficult
on threads is I found that sometimes certain
things aren't really working. Like when I try
to click the account creation date, for example,
on my laptop, sometimes I get a lot of errors,
but then when I do it on my phone, it works.
So I feel like the app works better on your phone
than it works on your computer, but I'm not doing
investigations on my phone. And then you also
have to do a lot of clicks to get there. So it
just takes a lot of time. Other than that, I
think I like that it has a keyword search function
with a recent tab. So I think it looks pretty
exhaustive like what you have on Twitter. So
I'm really happy about that. That it's not like
TikTok. Thanks for that little tip. I've linked
that in the chat, and I've personally just gone
and downloaded it. I have a similar one called
go4page, but that just takes a PNG, so it's good
to know that there's one for HTML. To say more
on that, this works for almost every website.
The only downside is that the .html files are
very big, so if you get someone's full timeline,
you might get 100 MB. But yeah, I think it's
kind of like a half manual, half automated way
for data collection. It's also a great way to
archive, right? We all know the trouble of trying
to archive something with your VPN on and then
you have to, it just takes ages. But with this
thing, you can just click it and save it for
later. And then if the account gets deleted,
you can just go back to the .html and make your
screenshots from there. And that's a great time
for me just to shout that we have a Bellingcat
auto archiver, which has recently had some updates
done to it. So please do check that out as well.
Just linked the guides that in the chat. We've
had quite a few questions and I'll let you take
a... Choc? Cool name. It's the most recent question
to kind of encompass this, but we've had quite
a few questions about how you spot Chinese Finney
or Spammelfarge accounts when their activity
seems to be non -discernible from other Finney
without an in -depth analysis. Are there any
telltale signs to spot Spammelfarge accounts,
specifically Chinese Spammelfarge accounts? Yes,
so I think some of the things that I just mentioned,
like for example, that they're mostly active
during PRC working hours, that is one that you
can always check. And you can also look at the
content. So for example, I mentioned a few things
like specific dissidents or Hong Kong or Xinjiang.
So these are like... target topics that they
always focus on. So if it's like a traditional
spam -a -flash account, it will talk about these
topics and it's very easy to spot. So you can
just go to, for example, you can go to People's
Daily's X account and then just go through its
repost or look in the comment section and you'll
find a bunch of spam -a -flash accounts. Now
it becomes more tricky if the spam -a -flash
accounts are like these mega -flash. type of
accounts, right? So they're not posting all of
this traditional pro PRC stuff. And you might
think like, oh, this could be, this could be
anyone running this influence operation. So how
we attributed those accounts to spamouflage is
by looking at the people who amplify it. So that's
where these kind of weird crypto accounts came
in. So we noticed that these accounts were amplifying
a lot of spamouflage and then suddenly like right
before the election, like five days before the
election, just all these new accounts were created
that criticize specific lawmakers. And they only
had three posts and nothing else. But when we
looked at the reposts, we saw that there was
actually quite some overlap with the accounts
that amplify the traditional spam of flash and
also PRC state media accounts. So that's how
we were able to attribute it. There's also more
on that in our US election observation report,
if you're interested. And I highly recommend
anyone to just read a lot of papers about spamouflage,
and you will see a lot of account characteristics
that you can use to find them. And once you find
a few, you can just keep snowballing. Someone
asked earlier actually in the chat, in the election
coverage that you saw, were they... only promoting
Trump rhetoric, or was it a little bit more broader
across the political spectrum? They also asked,
have you seen any similar campaigns targeting
European politicians, for example? For example,
last year was a huge election year across the
world. Have you seen any similar trends in terms
of European elections? So first, on the first
question, most of the traditional spam camouflage
accounts were anti -everything. They did say
a few things that maybe aligned more with Trump.
So they were, for example, a bit more, well,
they're anti -U .S. support for Ukraine, which
maybe you think that, okay, maybe that's more
closely connected to what Trump is saying. There
were also critical of the LGTBQ movement. So
maybe you can also draw some connections there.
But with the mega flush account, specifically
the accounts that are really pushing Trump, we
only found that for Trump. We didn't find similar
accounts that were supporting Biden. One interesting
thing, though, is that basically all of the spam
flush accounts that we were tracking were very
anti LGTBQ. And then like those five days before
the election, when these accounts were created
that criticize specific lawmakers, they were
criticizing Republican lawmakers for being anti
-LGBTQ. So that's just a completely different
standpoint kind of playing both sides. So that
was it was interesting to see that. And for Europe,
I haven't really been tracking the European election
season and also the accounts that I was tracking,
it was more quiet about the European elections,
but I'm pretty sure that some stuff did go on.
Maybe that's something our community can have
a look into. Something to track, guys. A little
homework for you all. You mentioned earlier that
often they use images of influencers. as part
of the accounts, they might not be aware, these
influencers might not be aware that their images
are being used or it's being used without their
consent or their control. Do you also see a trend
of proxy actors or self -interested actors helping
to boost propaganda narratives in Asia, particularly?
For example, social media influencers peddling
Chinese state lands. I think on your website,
it might attend economic capital owners or suitors.
Is there any pattern to there to what these influences
look like, say, or do they kind of transcend
algorithmic communities if they do exist? Yeah,
so one of our partners actually wrote a big article
on that. That's also on our medium. And she found
that on WeChat, so now you have these WeChat
stories, and she found that there were a lot
of influencers. Chinese and also Taiwanese influencers,
like living in Taiwan, who would then post a
lot of very pro PRC narratives. So to say like,
oh, Taiwan should join China and that kind of
stuff. But the conclusion there was that she
believes that they were only saying these things
because they know that they might be boosted
by the algorithm for saying that. And then they
were all running these online shops on the side.
And this is interesting because we found a similar
thing on TikTok. I think Voice of America also
wrote an article about that, where we found these
accounts that were kind of operated, seen from
out of Singapore, and they were AI avatars, often
of Western -looking women or Russian or Ukrainian
women. I think that's how it kind of started.
And they would start by giving this pro PRC propaganda
talk and then like halfway through the video
they would suddenly start promoting these vitamin
products and it's just so weird but there's this
this theory that these videos were maybe originally
made for PRC social media and they think like
oh if we post this kind of stuff the narrative
that the algorithm will push us because that's
what That's what Xi Jinping wants us to say.
And then we use that to then sell our products.
But this is still kind of like a hypothesis.
But we did find this in multiple different places.
That's really interesting. Yeah, I haven't seen
it linked with political comment, but I've definitely
seen news influences. fake ones, using a news
hub to then go and sell a well -being product,
for example. It's really interesting that that's
a tactic that they might be using, particularly
on TikTok. Thanks for sharing. And I've linked,
I think, is it called Patriotism for Sale, the
WeChat one? Yes, yeah, that's the one. I've linked
that within the chat. Do check out DoubleThink
Labs' medium, by the way. It's full of incredible
information. Hania Reyes just put, I've seen
hacked influencer accounts start to sell products
on TikTok too. Mashtar said maybe they modeled
some of it off Alex Jones info walls as they
were pushing vitamins. Somebody's just dropped
your DoubleThinkLab medium in the chat as well.
That's really cool. Thank you for doing that.
Still so many questions coming in. You mentioned
the big... the big term AI in your last answer,
could you tell us a little bit more about how
AI is being used in influence operations going
forwards and is that a new phenomenon or has
it been going on for a few years? I think right
now the thing that AI, that people are most afraid
of with AI are not are not really happening yet,
at least with PRC influence operations. It feels
like they are kind of experimenting with it.
So I kind of divide it up for myself. I think
AI is being used in four different ways. Now,
the first one is AI that is being used to deceive,
right? So you're trying to create photos or videos
that look real, but actually they're fake. And
you're really trying to fool people. I changed
their perception of things through these fake
videos or photos. And so far from the PRC influence
operations, I have not really seen that. Most
of the use of AI has been AI to convey a certain
idea. So they would, for example, create an AI
generated image of, I don't know, like Trump
and Netanyahu kissing or something like that.
And that would be like everybody knows that that
this is fake, right? It's very obvious, but it's
being used to get this idea out there, get this
visualization. I guess it's just a replacement
for a cartoon if you don't have time to draw
a cartoon yourself. And then there is another
method, which is also interesting, and that's
AI as a technical assistant. So for example,
we found Also, in the US election, we found that
some accounts, like a few days before the election,
they suddenly uploaded a video and it was like
speech in English and then some stock images
in the back. But we actually found that the speech
originates from a Baidu post in Chinese, like
an essay that someone posted. And yeah, we highly
suspect that they used AI to translate and then
also use text to speech AI to create the voice
to say this. So this opens up a lot of possibilities.
Right. So they can now just get any any data
from the Chinese cyberspace and just turn it
into a spoken like perfectly spoken English audio
fragment and just put it on Western social media.
There was something similar in Taiwan during
the election, so someone made a PRC threat actor
wrote this book about Tsai Ing -wen, the previous
president, and they called it The Secret History
of Tsai Ing -wen, which is just a book full of
nonsense about Tsai Ing -wen. And then they got
all of these AI avatars that they got made with
CapCut, so I think that belongs to ByteDance,
and they made all these AI avatars. to narrate
the book in kind of like a newsroom setting.
So yeah, just kind of using these AI tools to
very quickly get certain information out there.
And I think the most scary one, which is like
AI for full automation, which is the thing that
I am most afraid of, we've seen accounts experimenting
with it. Like we've seen posts, even posts by,
for example, Zhang Heqing, like the former the
former PRC diplomat. He has a lot of posts that
look a lot like they were AI generated. And I
think that that's where it becomes really scary
because that's the moment where you can just
create 10 ,000 bots and give them a wide range
of prompts. You can give them guidelines and
they just can create original content all the
time and it just won't stop. And especially because
OpenAI, like in February, they released their
newest report in which they found that PRC threat
actors were using JetGBT to create critical comments
of certain dissidents. Then you can just unleash
an army of 10 ,000 bots on one person, especially
if you have a model that you can locally run.
This is what I'm most afraid of, but it hasn't
really happened yet. Thanks so much for explaining
some of the tactics that they take in terms of
AI. In regards to other questions, Mini Joyce
has asked, what are the odds China uses cyber
capabilities to bolster their Femi operations?
I mean, more than they already do. Is there a
sense where they're using cyber capabilities
to bolster the reach of these kinds of operations?
I think that is definitely possible at some point,
especially if If you start looking at full automation
that I was just talking about, I think at that
point, they could definitely tap into some of
the cyber resources that they have. But I also
think that you would maybe see this on creating
news websites and stuff like that. I think you
would see it would be more prominent there than
on social media accounts. And yeah, of course,
they have Yeah, you have the rise of PRC platforms
right now. So yeah, TikTok and also Xiaolongsu,
like Red Note. People have also started downloading
that. And of course, there's also a lot of, I
think, embedded influence operation going on
within these apps with pushing certain content
and suppressing other content in the same way
that happens on Weibo or like the really proper
PRC platforms. So they're definitely using their
cyber capabilities there. As you asked earlier,
and this goes back to kind of people in the audience,
for example, who might be interested in getting
involved in all of this. What research, what
resources slash learning platform slash certifications
would you recommend someone trying to get into
the field of FEME? I think the field of FEME
is kind of Well, it's maybe similar to OSINT
in general, but the field of FMI, most of the
analysts, especially at a double think lab, all
come from kind of like a political science background.
I also have like a background in Chinese studies
and Asia Pacific studies. And then I learned
some coding and some data science, but we also
have an engineering team that can really help
us with more of the technical things. But I think
just some basic Python, especially pandas, could
be very useful. Because, for example, when we
write algorithms to detect coordinated inauthentic
behavior, we look a lot at, for example, post
similarity. And the time between posts is also
very important. So if you can very quickly. kind
of like manipulate the data to find similar posts
using certain Python packages and also find posts,
batch posts that were done in very rapid succession,
then that is definitely very helpful. I guess
if you're very good with Excel, you can also
do all of that stuff. I don't necessarily think
you need any certification. or specific certification.
At least I don't really have that. But I do recommend
that you just read as much research as possible
from, for example, DoubleThink Lab or DFR Lab
or Microsoft Threat Intelligence. You also have
Google is also doing research in all of this.
There's so many parties out there that have researched
spamouflage before. And yeah, you can kind of
imitate or copy their research methods. And as
a reminder, you can always ask for support and
help within this survey as well. lots of channels
for that, which I'm sure the mods can point you
to. Particularly when it comes to covering China
specifically, we have region -specific channels
as well where you can debate and talk about the
current news and current investigations. We've
also had a recommendation by somebody to check
out Sam Cooper's work. We'll go on Chinese interference.
There's a Canadian journalist who's uncovered
quite a bit about Chinese influence and interference
in Canada specifically. Do you, Jasper, do you
have any other recommendations for investigative
journalists perhaps that our team, our audience
could look at? I'm sorry, what do you mean precisely?
In regards to journalists within the space as
well, as you mentioned the organizations that
are working within the space or any journalists
that also stand out to you that are working within
this space and highlighting Chinese influence
operations. Yeah, so I've worked very closely
together with Wenhao Ma from VOA. So, yeah, he
has a sub stack and I'm sure he will lend a nice
job again soon and he will keep reporting on
it. But I think his China reporting has been
really good and he very often also touches on
issues related to influence operations. So I
definitely recommend following him. And then
there is some other, it's not really journalists,
but it's more like researchers also. So it's
called discourse power. It's also this sub stack.
And they also write a lot of excellent stuff
that also touches a lot on PRC influence operations,
but also PRC propaganda in general. Amazing,
getting so many reading recommendations right
now. Thank you. I've put both of those within
the chat. We only have five minutes left, so
I just want to make sure that we've covered everyone's
questions. We had a question earlier particularly
about the influence of Chinese operations or
digital operations in Africa. Are you familiar
with any large scale influence campaigns by the
PRC, for example, on the African continent? And
does that differ to their attempts, for example,
in Taiwan or in America? So far, I haven't seen,
I haven't really been tracking a lot of Africa
focused influence operations yet. I'm sure that
they They do exist, but in the account pool that
we've been tracking over the last few months,
Africa rarely popped up. I would say that countries
like the Philippines and Japan are a bigger topic.
Also now, obviously, India and Pakistan, that's
a very hot topic right now for these accounts.
As an African, we start to see a lot of Chinese
projects here, mostly in France. Fabulous. Great.
Well, thank you so much, Jasper, for your time
today. I wanted to just wrap up with a final,
final question, if that's okay. What tools are
absolutely vital to your deep dive research in
general? You mentioned a couple of threads earlier,
but which ones are absolutely vital to them?
research that you do. We like to leave people
with some kind of key resources to look into.
But other than that, thank you very much for
joining. And yeah, thank you everybody for listening.
Yeah, if you can just throw some tools away and
then we'll wrap. Yeah, so I really my single
most important tool is single file. If you don't
have access to official APIs or you don't have
access to any scrapers, you can use single file.
And if you have a little bit of Python or a chat
GPT account, then you can figure it out and you
can basically get any data and put it into a
neat data format and then analyze it. So yeah,
definitely just single file. I think we're going
to have to start a little Python learning group.
I know quite a few people know it, but I think
we should start a little one -up in the Discord
server and work together on that. Thanks so much
for sharing Single File as a resource for us,
and thanks again for joining us on this particular...
talk. It's been super fascinating and hope to
see you back in the Discord server again soon.
Thanks so much, Jesper. Thank you for having
me. Thank you, everybody. Thank you for listening
to the stage talk. If you'd like to catch a stage
tour live where you can ask the guest questions,
join the Bellingcat Discord server by visiting
www .discord .gg slash Bellingcat. The music
you've heard is titled Dawn by Newer Self and
is courtesy of Artlist.